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REMARKS 

Applicant has carefully reviewed and considered the Office Action mailed on August 21, 
2007 , and the references cited therewith. 

Claims 17, 21, 24-25, and 41-42 are amended, and claims 2-3. 7. 11-16. 18-20, 22-23, 26- 
29. and 39-40 are canceled; as a result, claims 1. 4-6. 8-10. 17. 21. 24-25 30-38. and 41-43 are 
now pending in this Application, of which claims 1,17, and 36 are independent. 

Claim 17 has been amended to substantially incorporate the limitations of claims 19 and 

22. 

Other amendments have been made to correct claim dependencies. No new matter has 
been added. 
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$ 102 REJECTIONS 

The Office Action dated October 27, 2008, rejected claims 1-32 and 34-43 under 35 
U.S.C. § 102(b) as being anticipated by anticipated by Waldin et al. . U.S. Patent No. 6,094,73 1 . 
Applicant respectfully submits that these rejections were improper because Waldin does not 
disclose determining both a first and third hash value associated with the object, or determining 
both a second and fourth set of hash values, as recited in the claims. 

Claim 1 recites: 

A method for filtering out exploits passing through a device, comprising: 
receiving an object to be inspected directed to the device; 
determining a first hash value associated with the object to be inspected; 
determining a second set of hash values associated with objects that have 
previously been scanned; 

if the first hash value matches at least one of the hash values in the second set, 

determining a third hash value associated with the object to be inspected; 
determining a fourth set of hash values associated with the objects that have 
previously been scanned; and 

if the third hash value matches at least one of the hash values in the fourth set, 
immediately processing the object to be inspected. 

The Office Action asserted that column 6, lines 18-21 of Waldin disclose, "determining a 
first hash value associated with the object to be inspected." However, this portion of Waldin 
discloses determining a size of the file 1, but does not disclose determining a hash value of the 
file 1 or of the size of the file 1 . 

Similarly, the Office Action asserted that column 6, lines 18-21, disclose, "determining a 
second set of hash values associated with objects that have previously been scanned." This 
portion of Waldin discloses comparing the determined size of the file 1 with a previously stored 
size. This portion of Waldin does not disclose hash values of the stored sizes. 

The Office Action also asserted that column 6, lines 18-21 of Waldin disclose, "if the 
first hash value matches at least one of the hash values in the second set." However, as discussed 
above, this portion of Waldin discloses comparing the size of the file 1 to a size which has been 
previously stored. This portion of Waldin does not disclose anything about hash values. The 
failure of this portion of Waldin to disclose hash values renders Waldin insufficient to anticipate 
claim 1, and Applicant respectfully requests that the rejection of claim 1 be withdrawn. 

Applicant further requests that the rejections of claims 4-6, 8-10, 30-32, and 37-38 be 
withdrawn at least due to their dependence on claim 1 . 
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Applicant further requests that the rejection of claim 6 be withdrawn due to Waldin's 
failure to disclose, "forwarding the object to be inspected to an output component without 
scanning the object to be inspected." The Office Action cited column 6, line 49 to column 7, line 
3 as disclosing the recitation of claim 6. However, this portion of Waldin discloses examining 
the authenticity of a digital signature of the file. Applicant respectfully submits that this 
examination of the digital signature would constitute a "scanning," and that this portion of 
Waldin cannot fairly be read to disclose, "forwarding the object to be inspected to an output 
component without scanning the object to be inspected," as recited in claim 6. Accordingly, 
Applicant respectfully requests that the rejection of claim 6 be withdrawn for at least this 
additional reason. 

Applicant further requests that the rejections of claims 9 and 10 be withdrawn for the 
additional reason that Waldin does not disclose updating any set of hash values based on lack of 
a match. The Office Action cited column 6, lines 21-25 and 42-45 as disclosing updating sets of 
hash values based on lack of a match. However, these portions of Waldin disclose determining 
that the contents of the file have been changed or rescanning the file based on a lack of a match, 
but do not disclose updating the set of hash values based on the lack of a match. Therefore, 
Applicant respectfully requests that the rejections of claims 9 and 10 be withdrawn for at least 
this additional reason. 

Claims 12, 14-16, and 39-40 have been canceled, rendering the rejections of these claims 
moot. Accordingly, Applicant respectfully requests that the rejections of these claims be 
withdrawn. 

The Office Action rejected claim 17 based on Waldin . Claim 17 has been amended to 
substantially incorporate the limitations of now-canceled claims 19 and 22. Claim 17, as 
amended, now recites all the hash values recited in claim 1 . Accordingly, Applicant respectfully 
requests that the rejection of claim 17 be withdrawn for the reasons discussed above with respect 
to claim 1 . Applicant requests that the rejections of claims 1 9 and 22 be withdrawn due to their 
cancellation. Applicant further requests that the rejections of claims 21, 24-25, 34-35, and 41-42 
be withdrawn at least due to their dependence on claim 17. 

The Office Action rejected claim 36 based on column 6, lines 17-55 of Waldin . 
Applicant respectfully submits that this portion of Waldin does not disclose processing the object 
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as a malicious object if a match is found between the sophisticated signature hash value (SSHV) 
of the object to any of the SSHVs of the known object, as recited in claim 36. Lines 49-53 of 
column 6 of Waldin disclose examining the authenticity of the digital signature of the file if the 
recently computed hash values are identical to the pre-stored hash values. Applicant respectfully 
submits that examining the authenticity of the file does not constitute treating the file as a 
malicious object — rather, the match causes the program of Waldin to treat the file as non- 
malicious, and merely causes the program to determine the authenticity of the file. Accordingly, 
Applicant respectfully submits that Waldin does not anticipate claim 36, and respectfully 
requests that the rejection of claim 36 be withdrawn. 

Applicant further requests that the rejection of claim 43 be withdrawn at least due to its 
dependence on claim 36. 
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$ 103 REJECTIONS 

Claim 33 was rejected under 35 U.S.C. § 103(a) as being unpatentable over Waldin in 
view of Chen et al , U.S. Patent No. 5,960,170. Applicant respectfully submits that Chen does 
not compensate for the deficiency of Waldin in failing to disclose the elements of independent 
claim 1, and requests that this rejection be withdrawn at least due to claim 33 's dependency on 
claim 1 . 
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CONCLUSION 



Applicant respectfully submits that the claims are in condition for allowance and 
notification to that effect is earnestly requested. The Examiner is invited to telephone 
Applicant's attorney (208-286-1013) to facilitate prosecution of this Application. 

If necessary, please charge any additional fees or credit overpayment to Deposit Account 
No. 50-3521 



Respectfully submitted, 



Brake Hughes Bellermann LLP 
Customer Number: 53666 
208-286-1013 



Date January 26. 2009 



By /Shane A. Kennedy/ 
Shane A. Kennedy 
Reg. No. 54,760 



